CWE-822— Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Windows Installer allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuin…

The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on fail…

The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That …

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those arra…

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violatio…

Memory corruption while processing rear sensor IOCTL calls.

Memory Corruption when copying large input data exceeds normal allocation limits.

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from n…

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the curre…

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malici…

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory corruption when another driver calls an IOCTL with invalid input/output buffer.

Memory corruption when processing camera sensor input/output control codes with invalid output buffers.

Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.